# B.3 Lack of transparency and explainability

AI-related risk source: Where the system's workings or the reasons for its outputs cannot be understood, errors go undetected, accountability weakens and stakeholders lose trust. The artefact behind the answer is assessment of the system's interpretability and the explanations available. Use lack of transparency and explainability as a prompt in the identification step, not as a finding.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause B.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related risk source: Where the system's workings or the reasons for its outputs cannot be understood, errors go undetected, accountability weakens and stakeholders lose trust.

## Where generative AI changes the answer

Opacity is structural here: the organisation often cannot inspect the model at all, so the risk has to be managed through evidence about behaviour.

## Who it binds

The assessment team that runs identification, and the business owner who knows the use.

## Evidence an auditor samples

- Assessment of the system's interpretability and the explanations available

## The test you can run

Ask the assessment team to name the risk sources they considered. Compare the list with the ones present in the use.

## Common failures

- Opaque model used where explanation is required

## Before the draft publishes

Add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.